Most people associate cyberattacks with stolen passwords, malicious software, or compromised servers. Message bombing is different. It targets something more ordinary: the communication channels people rely on every day.
The article about FloodCRM examines a tool associated with email, SMS, and call bombing in Australia. These services are designed to send a large number of messages or calls to a chosen recipient. The individual actions may look like normal notifications, but the combined effect can make a phone number or email account difficult to use.
What caught my attention is how simple the basic idea is. A message bomber may not need to break into the victim’s device. Instead, it can abuse legitimate websites, notification systems, forms, and communication services. This makes it a useful example of how ordinary automation can become a cybersecurity problem when it is used without consent.
How message bombing works
An email or SMS bomber repeatedly triggers messages to the same address or phone number. A call bomber produces a similar result through automated or repeated calls.
Depending on the service, the messages might come from one source or from many unrelated platforms. Some attacks abuse registration pages, password recovery systems, callback forms, marketing tools, or application programming interfaces. These systems are supposed to help real users, but weak rate controls can allow someone to trigger them repeatedly.
The word “bomber” can make this sound more technically sophisticated than it is. In many cases, the main ingredients are automation, access to communication services, and a target’s contact information. The damage comes from volume and persistence.
That does not make the activity harmless. A flood of notifications can interfere with work, disrupt sleep, consume mobile resources, and make important messages difficult to find. Repeated calls can also be particularly invasive because they demand immediate attention.
FloodCRM appears in this context as a tool for coordinating this type of activity. Regardless of how such a service describes itself, a technical label or polished interface does not turn harassment into legitimate testing.
More than an annoying prank
One reason message bombing matters to cybersecurity students is that it affects availability. Security is often discussed through the confidentiality, integrity, and availability model. Message flooding primarily targets the availability of a communication channel.
If an inbox receives hundreds or thousands of unwanted emails, it may still be technically online, but it becomes much less useful. The same applies to a phone that is constantly ringing or receiving SMS notifications.
There is also a more serious possibility. Email bombing is sometimes used as a distraction after an account compromise or fraudulent transaction. An attacker may flood the victim’s inbox so that a genuine password change, purchase receipt, bank warning, or login notification becomes harder to notice.
This does not mean every message flood indicates account theft. It does mean that a sudden flood should not automatically be dismissed as spam. The victim should check carefully for security alerts and unexpected activity.
Message bombing also creates costs for third parties. When legitimate websites are abused to send notifications, those businesses may pay for the SMS messages, calls, or email delivery. Their sender reputation can suffer, and their support teams may have to investigate complaints from people who never requested the messages.
Why consent changes everything
There are legitimate reasons to generate high volumes of traffic. Developers perform load testing, security teams test rate controls, and telecommunications providers evaluate the capacity of their systems.
The important differences are authorization, scope, and control.
A legitimate test is performed against systems the tester owns or has written permission to assess. It has defined limits, monitoring, and a plan to stop the test if something goes wrong. Selecting another person’s phone number or email address without permission is not a security test.
Calling it a prank does not change the impact. The recipient did not agree to participate, and the affected websites, carriers, or messaging providers probably did not authorize their infrastructure to be used that way either.
The legal situation in Australia
The exact legal consequences depend on how the tool was used, what systems were affected, and what the person intended. It is therefore better not to reduce the issue to one law or assume that every case will be treated identically.
Australia’s federal Criminal Code contains computer and telecommunications offenses that may become relevant when someone causes unauthorized impairment or uses a carriage service to menace, harass, or cause offense. State and territory laws concerning stalking, harassment, threats, and misuse of communications may also apply.
Other legislation can be relevant in narrower situations. The Spam Act regulates certain commercial electronic messages, while telemarketing and calling activities can fall under separate rules. Not every message bombing incident is commercial spam, however, so the Spam Act should not be treated as a universal explanation for why the conduct may be unlawful.
The key point is that sending automated communications is not illegal by itself. Businesses send notifications every day. The legal risk comes from factors such as lack of authorization, harmful intent, harassment, interference with communications, and damage caused to people or systems.
Someone who develops, distributes, or operates a bombing service may also face different questions from a person who uses it against a target. A disclaimer on a website does not necessarily protect an operator if the service is designed or promoted for abusive activity.
What to do if messages suddenly begin flooding in
A victim’s first reaction may be to delete everything or disable the account. It is usually better to pause and preserve some evidence.
Useful steps include:
- Save screenshots and note when the activity started.
- Look for unusual password resets, login alerts, purchases, or banking notifications hidden among the messages.
- Review important accounts directly instead of following links inside unexpected emails or texts.
- Change passwords if there are signs of compromise, especially if a password was reused.
- Enable multifactor authentication, preferably through an authenticator app, security key, or passkey where available.
- Contact the email provider, mobile carrier, bank, or relevant service if suspicious activity appears.
- Report serious incidents through Australia’s official cybercrime reporting channels or contact police if there are threats or immediate safety concerns.
Victims should also be careful with unsubscribe links. Some messages may be genuine notifications generated through abused forms, while others may be phishing attempts mixed into the flood. Opening every link can create additional risk.
What developers can learn from this
Message bombing is partly a defensive engineering problem. Any application that sends email, SMS messages, authentication codes, or automated calls should assume that someone may try to abuse that feature.
Basic protections include rate limiting by account, IP address, device, and destination. A system should not allow unlimited messages to be sent to the same phone number simply because requests come from different sessions.
Developers can also use temporary delays, verification steps, behavioral analysis, spending limits, and alerts for unusual sending patterns. CAPTCHA can help in some situations, but it should not be the only defense. Attackers can sometimes bypass or outsource CAPTCHA solving, and aggressive challenges can create accessibility problems for legitimate users.
Monitoring is equally important. A sudden increase in outbound messages may indicate abuse long before complaints reach a support team. Organizations should be able to suspend suspicious workflows without shutting down notifications for everyone.
A small tool can create a real security incident
The FloodCRM discussion is interesting because it shows that a cyberattack does not always require advanced exploitation. Sometimes the attacker simply finds a process that can be repeated and removes the normal human limits.
Email, SMS, and voice systems are connected to real infrastructure, real costs, and real people. Flooding them can cause operational disruption, conceal more serious fraud, and turn legitimate services into unwilling participants.
For me, the main lesson is that automation is neutral only until someone decides how to use it. The same concepts that help developers scale useful systems can also scale harassment. Understanding that difference is an important part of studying cybersecurity, especially as more communication tools become accessible through APIs and cloud platforms.
Original source: https://telegra.ph/FloodCRM-Explained-Australia-What-Is-the-Email-SMS–Call-Bomber-Tool-and-Why-Its-Illegal-08-12